From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk,
Shan Hai <shan.hai@windriver.com>,
Benjamin Herrenschmidt <benh@kernel.crashing.org>
Subject: [ 14/49] powerpc/vdso: Remove redundant locking in update_vsyscall_tz()
Date: Sun, 13 Jan 2013 17:43:09 +0000 [thread overview]
Message-ID: <20130113174258.756399429@decadent.org.uk> (raw)
In-Reply-To: <20130113174255.736888844@decadent.org.uk>
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shan Hai <shan.hai@windriver.com>
commit ce73ec6db47af84d1466402781ae0872a9e7873c upstream.
The locking in update_vsyscall_tz() is not only unnecessary because the vdso
code copies the data unproteced in __kernel_gettimeofday() but also
introduces a hard to reproduce race condition between update_vsyscall()
and update_vsyscall_tz(), which causes user space process to loop
forever in vdso code.
The following patch removes the locking from update_vsyscall_tz().
Locking is not only unnecessary because the vdso code copies the data
unprotected in __kernel_gettimeofday() but also erroneous because updating
the tb_update_count is not atomic and introduces a hard to reproduce race
condition between update_vsyscall() and update_vsyscall_tz(), which further
causes user space process to loop forever in vdso code.
The below scenario describes the race condition,
x==0 Boot CPU other CPU
proc_P: x==0
timer interrupt
update_vsyscall
x==1 x++;sync settimeofday
update_vsyscall_tz
x==2 x++;sync
x==3 sync;x++
sync;x++
proc_P: x==3 (loops until x becomes even)
Because the ++ operator would be implemented as three instructions and not
atomic on powerpc.
A similar change was made for x86 in commit 6c260d58634
("x86: vdso: Remove bogus locking in update_vsyscall_tz")
Signed-off-by: Shan Hai <shan.hai@windriver.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/powerpc/kernel/time.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index b3b1435..6f6b1cc 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -770,13 +770,8 @@ void update_vsyscall_old(struct timespec *wall_time, struct timespec *wtm,
void update_vsyscall_tz(void)
{
- /* Make userspace gettimeofday spin until we're done. */
- ++vdso_data->tb_update_count;
- smp_mb();
vdso_data->tz_minuteswest = sys_tz.tz_minuteswest;
vdso_data->tz_dsttime = sys_tz.tz_dsttime;
- smp_mb();
- ++vdso_data->tb_update_count;
}
static void __init clocksource_init(void)
next prev parent reply other threads:[~2013-01-13 17:53 UTC|newest]
Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-01-13 17:42 [ 00/49] 3.2.37-stable review Ben Hutchings
2013-01-13 17:42 ` [ 01/49] ext4: fix extent tree corruption caused by hole punch Ben Hutchings
2013-01-13 17:42 ` [ 02/49] i915: ensure that VGA plane is disabled Ben Hutchings
2013-01-13 17:42 ` [ 03/49] ext4: check dioread_nolock on remount Ben Hutchings
2013-01-13 17:42 ` [ 04/49] jbd2: fix assertion failure in jbd2_journal_flush() Ben Hutchings
2013-01-13 17:43 ` [ 05/49] hwmon: (lm73} Detect and report i2c bus errors Ben Hutchings
2013-01-13 17:43 ` [ 06/49] ext4: do not try to write superblock on ro remount w/o journal Ben Hutchings
2013-01-13 17:43 ` [ 07/49] PCI: Reduce Ricoh 0xe822 SD card reader base clock frequency to 50MHz Ben Hutchings
2013-01-13 17:43 ` [ 08/49] mm: Fix PageHead when !CONFIG_PAGEFLAGS_EXTENDED Ben Hutchings
2013-01-13 17:43 ` [ 09/49] cifs: adjust sequence number downward after signing NT_CANCEL request Ben Hutchings
2013-01-13 17:43 ` [ 10/49] tmpfs mempolicy: fix /proc/mounts corrupting memory Ben Hutchings
2013-01-13 17:43 ` [ 11/49] p54usb: add USB ID for T-Com Sinus 154 data II Ben Hutchings
2013-01-13 17:43 ` [ 12/49] ath9k_hw: Fix RX gain initvals for AR9485 Ben Hutchings
2013-01-13 17:43 ` [ 13/49] p54usb: add USBIDs for two more p54usb devices Ben Hutchings
2013-01-13 17:43 ` Ben Hutchings [this message]
2013-01-13 17:43 ` [ 15/49] powerpc: Add missing NULL terminator to avoid boot panic on PPC40x Ben Hutchings
2013-01-13 17:43 ` [ 16/49] drm/radeon: add connector table for SAM440ep embedded board Ben Hutchings
2013-01-13 17:43 ` [ 17/49] drm/radeon: add connector table for Mac G4 Silver Ben Hutchings
2013-01-14 18:48 ` Albrecht Dreß
2013-01-13 17:43 ` [ 18/49] drm/radeon: Properly handle DDC probe for DP bridges Ben Hutchings
2013-01-13 17:43 ` [ 19/49] NFSv4: Add ACCESS operation to OPEN compound Ben Hutchings
2013-01-15 18:42 ` Herton Ronaldo Krzesinski
2013-01-16 1:08 ` Ben Hutchings
2013-01-13 17:43 ` [ 20/49] NFSv4: dont check MAY_WRITE access bit in OPEN Ben Hutchings
2013-01-13 17:43 ` [ 21/49] NFS4: nfs4_opendata_access should return errno Ben Hutchings
2013-01-13 17:43 ` [ 22/49] NFS: Fix access to suid/sgid executables Ben Hutchings
2013-01-13 17:43 ` [ 23/49] drm/nouveau: fix init with agpgart-uninorth Ben Hutchings
2013-01-13 17:43 ` [ 24/49] video: mxsfb: fix crash when unblanking the display Ben Hutchings
2013-01-13 17:43 ` [ 25/49] nfs: fix null checking in nfs_get_option_str() Ben Hutchings
2013-01-13 17:43 ` [ 26/49] SUNRPC: Ensure that we free the rpc_task after cleanups are done Ben Hutchings
2013-01-13 17:43 ` [ 27/49] ACPI / scan: Do not use dummy HID for system bus ACPI nodes Ben Hutchings
2013-01-13 17:43 ` [ 28/49] mm: limit mmu_gather batching to fix soft lockups on !CONFIG_PREEMPT Ben Hutchings
2013-01-13 17:43 ` [ 29/49] drivers/rtc/rtc-vt8500.c: correct handling of CR_24H bitfield Ben Hutchings
2013-01-13 17:43 ` [ 30/49] drivers/rtc/rtc-vt8500.c: fix handling of data passed in struct rtc_time Ben Hutchings
2013-01-13 17:43 ` [ 31/49] udf: dont increment lenExtents while writing to a hole Ben Hutchings
2013-01-13 17:43 ` [ 32/49] epoll: prevent missed events on EPOLL_CTL_MOD Ben Hutchings
2013-01-13 17:43 ` [ 33/49] rt2x00: Dont let mac80211 send a BAR when an AMPDU subframe fails Ben Hutchings
2013-01-13 17:43 ` [ 34/49] mac80211: introduce IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL Ben Hutchings
2013-01-13 17:43 ` [ 35/49] Revert: "rt2x00: Dont let mac80211 send a BAR when an AMPDU subframe fails" Ben Hutchings
2013-01-13 17:43 ` [ 36/49] ftrace: Do not function trace inlined functions Ben Hutchings
2013-01-13 17:43 ` [ 37/49] sparc: huge_ptep_set_* functions need to call set_huge_pte_at() Ben Hutchings
2013-01-13 17:43 ` [ 38/49] inet: Fix kmemleak in tcp_v4/6_syn_recv_sock and dccp_v4/6_request_recv_sock Ben Hutchings
2013-01-13 17:43 ` [ 39/49] net: sched: integer overflow fix Ben Hutchings
2013-01-13 17:43 ` [ 40/49] tcp: implement RFC 5961 3.2 Ben Hutchings
2013-01-13 17:43 ` [ 41/49] tcp: implement RFC 5961 4.2 Ben Hutchings
2013-01-13 17:43 ` [ 42/49] tcp: refine SYN handling in tcp_validate_incoming Ben Hutchings
2013-01-13 17:43 ` [ 43/49] tcp: tcp_replace_ts_recent() should not be called from tcp_validate_incoming() Ben Hutchings
2013-01-13 17:43 ` [ 44/49] tcp: RFC 5961 5.2 Blind Data Injection Attack Mitigation Ben Hutchings
2013-01-13 17:43 ` [ 45/49] [SCSI] mvsas: Fix oops when ata commond timeout Ben Hutchings
2013-01-13 17:43 ` [ 46/49] RDMA/nes: Fix for crash when registering zero length MR for CQ Ben Hutchings
2013-01-13 17:43 ` [ 47/49] RDMA/nes: Fix for terminate timer crash Ben Hutchings
2013-01-13 17:43 ` [ 48/49] ACPI : do not use Lid and Sleep button for S5 wakeup Ben Hutchings
2013-01-13 17:43 ` [ 49/49] aoe: do not call bdi_init after blk_alloc_queue Ben Hutchings
2013-01-13 22:44 ` [ 00/49] 3.2.37-stable review Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130113174258.756399429@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=benh@kernel.crashing.org \
--cc=linux-kernel@vger.kernel.org \
--cc=shan.hai@windriver.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox